Veeam Vulnerabilities: 50 CVEs in 2026 So Far, and All 4 in CISA KEV Are Ransomware-Linked

As of November 12, 2026, Veeam vulnerabilities total 120 CVEs, 50 of them published this year. All 4 that CISA lists as exploited are Backup and Replication flaws flagged for known ransomware use. The only fully patched VBR builds are 13.1.2.57, 13.0.3.63 and 12.3.2.4934; the June 2026 build 12.3.2.4854 still has 4 open.

Key findings

• Veeam’s security bulletins and NVD list 120 Veeam CVEs since 2015. 50 came out from January 1 to November 12, 2026, against 9 in the same months of 2025 and 29 in 2024.
• All 4 Veeam CVEs in CISA’s KEV catalog are Backup and Replication flaws, and CISA flags all 4 as used in ransomware campaigns. Across the whole catalog the share is 20.3% (361 of 1,779).
• Backup software is a ransomware favorite in KEV: 7 of 13 entries from six backup vendors (54%) carry the Known ransomware flag.
• The gap from Veeam bulletin to KEV listing fell from 276 days (CVE-2022-26500) to 168 days (CVE-2023-27532) to 43 days (CVE-2024-40711).
• VBR 12.1.2.172, a May 2024 build, carries 31 open CVEs, 10 of them rated 9.0 or higher and 1 in KEV. Veeam ships no fixes for 12.0, 12.1 or 12.2: every v12 fix since December 2024 is a 12.3 build.
• 8 VBR CVEs since March 2025 let an authenticated domain user run code on backup infrastructure, and Veeam’s text says 4 of them hit only domain-joined servers.
• 35 of the 50 CVEs from 2026 still show “Awaiting Analysis” in NVD, so scanners that rely on NVD enrichment can miss them.

Fixed-build lookup by VBR major version

The table answers the most common question about Veeam vulnerabilities: which build closes everything. “Open” counts come from our matrix of 53 VBR CVEs that Veeam lists in KB3103, its running list of security fixes per VBR build, plus 2 CVEs from bulletins that list does not carry. Lifecycle dates are from Veeam’s product lifecycle page.

Veeam’s lifecycle page says security updates continue during End of Fix. Bulletins from 2024 on say unsupported versions are not tested but are likely affected and should be considered vulnerable, which is how we count v11.

Check your Veeam Backup and Replication build

Veeam Backup and Replication version matrix

Each row is a Veeam bulletin, each column a VBR build named in KB3103 or a bulletin, and each red cell shows how many of that bulletin’s CVEs are still open on that build. From 12.0 on, every Veeam security fix for VBR lands on one of these milestone builds, so any build in between shares the status of the milestone below it.

Figure 1. Open Veeam CVEs by VBR build and bulletin, as of November 12, 2026

Rows count only the CVEs Veeam fixes through VBR builds (53 in total, including CVE-2022-26503 in the Windows agent, which a VBR patch carried). Shared CVEs appear in both KB4830 and KB4831. Totals at the bottom count each CVE once. Amber cells on v11 are CVEs fixed on v12 after v11’s support ended. Grey means Veeam’s text says the train is not affected.

Why backup servers are a ransomware target: the KEV record

Every Veeam CVE that CISA has confirmed as exploited sits in Backup and Replication, the server that holds the credentials for the hosts it protects. CVE-2023-27532 let an unauthenticated user request the encrypted credentials stored in the configuration database over TCP 9401, per KB4424. CVE-2022-26500 and 26501 let attackers upload and run code through the Veeam Distribution Service on TCP 9380 without logging in, per KB4288. That is the reason attackers want this box: one service account touches every protected host. Our analysis of ransomware initial access vectors shows how exploited vulnerabilities compare with stolen credentials and phishing as entry points.

Figure 2. Days from Veeam bulletin to CISA KEV listing

CISA advisory AA24-109A on Akira, revised November 13, 2025, says Akira actors tunnel through a router and then exploit “the Veeam Backup and Replication component of unpatched Veeam backup servers” (CVE-2023-27532 and CVE-2024-40711). It also says they abused Veeam.Backup.MountService.exe for privilege escalation through CVE-2024-40711, and it lists two Akira tools aimed at Veeam: VeeamHax.exe, a plaintext credential leaking tool, and Veeam-Get-Creds.ps1, which obtains and decrypts accounts from Veeam servers. None of the 50 CVEs from 2026 is in KEV as of catalog version 2026.11.10, released Nov 10, 2026. KEV flags lag exploitation, so that is not evidence they are safe.

Backup software in KEV, all vendors

Figure 3. KEV entries for backup software vendors by ransomware flag

Backup vendors here are Veeam, Veritas, Commvault, Acronis, NAKIVO and Arcserve, matched on KEV’s vendor field (Cohesity and Rubrik have no entries). Our CISA KEV analysis covers the catalog as a whole.

Veeam vulnerabilities by product

Backup and Replication accounts for 55 of the 120 CVEs. The 2026 jump is broad: Veeam ONE went from 0 CVEs in the 2025 window to 9, and Backup for Microsoft 365 had its first 4.

Figure 4. Veeam CVEs per year by product family

*2026 runs to November 12. Years use the earliest Veeam bulletin date, or the NVD publish date for 4 older CVEs that have no Veeam bulletin. One 2016 CVE is outside the chart. Scores switched to CVSS v4.0 in most bulletins from May 2026, so 2026 scores are not directly comparable with earlier v3.1 scores.

What the bulletins say about how these flaws work

NVD is behind. 35 of the 50 CVEs from 2026 show Awaiting Analysis, and since 2024 the median gap from Veeam’s bulletin to the NVD record is 1 day, with 7 CVEs taking 20 days or more. Three CVEs from KB4902 (August 25, 2026) reached NVD on October 7, 43 days later. Veeam’s KB pages are the faster source.

Every Veeam CVE, with fixed build

Red rows are in CISA KEV. CVSS is the score Veeam prints in the bulletin; “NVD” marks the 7 CVEs where we fell back to NVD. Veeam’s 2022 bulletin KB4288 prints one score (9.8) for CVE-2022-26500 and 26501, while NVD scores 26500 at 8.8.

What this means for MSPs

Get every VBR server to one of three builds. 13.1.2.57, 13.0.3.63 or 12.3.2.4934. Anything on 12.0, 12.1 or 12.2 needs an upgrade, not a patch, because Veeam has shipped no fix on those releases since December 2024. Version 12 security fixes end February 28, 2027, so plan the v13 move now. Our backup and disaster recovery guide covers how to keep restore points isolated while you do it.

Take backup servers off the domain. Veeam’s own bulletins tie 4 critical RCEs to domain-joined servers. A workgroup VBR server with its own credentials removes that path.

Audit Veeam roles. 22 VBR CVEs since 2024 start from a Viewer or Operator role. Remove anyone in Users and Roles who does not need access.

VSPC needs its own window. Service Provider Console has 14 CVEs, 6 of them in 2026. 9.3.0.35057 (KB4893, August 4, 2026) fixes CVE-2026-58073 (9.5), where an unauthenticated attacker can impersonate a managed agent and get its credentials. For CVE-2026-32998, Veeam says 9.2 deployments with alarm script execution left at the default are not affected. VSPC 8 reaches End of Support in December 2026.

Cloud Connect providers: patch for CVE-2026-58069. It lets an authenticated tenant read arbitrary files on the service provider host. It is fixed in 13.1.0.411, 13.0.3.63 and 12.3.2.4934.

Rotate Application-Aware Processing passwords on v13. KB4902 says CVE-2026-58070 wrote guest OS credentials to logs in cleartext and that the fix does not delete logs already written.

Watch Veeam’s KB feed, not just NVD. Veeam’s security listing at veeam.com/knowledge-base.html?type=security had its newest bulletin, KB4961, on October 29, 2026, and a Linux kernel impact statement, KB4966, on November 6.

Frequently asked questions

Is there a vulnerability in Veeam Backup & Replication?

Yes, several, all with fixes. The newest VBR bulletin, KB4948 of October 27, 2026, fixes CVE-2026-108142 (CVSS 9.1, unauthenticated authorization bypass on the CDP Coordinator Service) in 13.1.2.57 and 13.0.3.63. On version 12, KB4934 of October 6, 2026 fixes CVE-2025-64393 (9.4) in 12.3.2.4934. No VBR build below those three is fully patched.

What are the Veeam vulnerabilities in 2026?

From January 1 to November 12, 2026, Veeam published 50 CVEs, more than in any full earlier year, 16 of them rated 9.0 or higher. 24 affect Backup and Replication, 9 Veeam ONE, 6 Service Provider Console, 4 Backup for Microsoft 365, 3 the Management Pack and 4 the Windows and Linux agents. None of the 2026 CVEs is in CISA KEV as of catalog version 2026.11.10.

Which Veeam vulnerabilities are exploited by ransomware?

CISA KEV lists 4 Veeam CVEs and flags all 4 as known ransomware use: CVE-2022-26500 and CVE-2022-26501 (added December 13, 2022), CVE-2023-27532 (August 22, 2023) and CVE-2024-40711 (October 17, 2024). CISA’s Akira advisory AA24-109A, revised November 13, 2025, names CVE-2023-27532 and CVE-2024-40711.

Which Veeam 12.3 vulnerabilities are still open?

On 12.3.2.4854, the June 2026 build, 4 CVEs are open: CVE-2025-64393 (9.4), CVE-2026-58069 (8.3), CVE-2026-93026 (6.1) and CVE-2025-64392 (4.8). All four are fixed in 12.3.2.4934 (12.3.2 P4), which KB4934 says does not apply to version 13. Version 12 reaches End of Support on February 28, 2027.

What are the Veeam 13 vulnerabilities?

Our matrix counts 16 VBR CVEs that affect the first v13 build, 13.0.0.4967, across KB4792, KB4831, KB4852, KB4902 and KB4948. The 13.0 train is clean at 13.0.3.63 and the 13.1 train at 13.1.2.57. Builds 13.1.0.411 and 13.1.1.18 still carry 3: CVE-2026-108140, 108141 and 108142.

How fast do Veeam vulnerabilities get exploited?

The gap shrank with each KEV listing. CVE-2022-26500 and 26501 reached KEV 276 days after Veeam’s March 12, 2022 bulletin, CVE-2023-27532 168 days after, and CVE-2024-40711 43 days after its September 4, 2024 bulletin. CISA gave federal agencies 21 days to patch each one.

Free to cite and republish with a link.

Methodology

References

1. Veeam, Knowledge Base, Security articles. Accessed November 2026.
2. Veeam KB3103, List of Security Fixes and Improvements in Veeam Backup and Replication. Accessed November 2026.
3. Veeam KB4948, Vulnerabilities Resolved in VBR 13.1.2; KB4934, VBR 12.3.2 P4; KB4902, VBR 13.1; KB4869, VBR 12.3.2.4854. Accessed November 2026.
4. Veeam KB4852; KB4831; KB4830; KB4792; KB4771; KB4743; KB4724. Accessed November 2026.
5. Veeam KB4693; KB4682; KB4649, Veeam Security Bulletin September 2024; KB4581; KB4424; KB4288; KB4290. Accessed November 2026.
6. Veeam KB4893, VSPC 9.3; KB4853, VSPC 9.2.1; KB4679; KB4575. Accessed November 2026.
7. Veeam KB4892, Veeam ONE 13.1; KB4905; KB4951; KB4957, Backup for Microsoft 365 8.6; KB4961, Management Pack 13.1; KB4966, CVE-2026-98432 impact statement. Accessed November 2026.
8. Veeam, Product Lifecycle. Accessed November 2026.
9. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
10. CISA, AA24-109A, #StopRansomware: Akira Ransomware, revised November 13, 2025. Accessed November 2026.
11. NIST NVD API 2.0. Accessed November 2026.